====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ kworker/u9:4/5624 is trying to acquire lock: ffffffff91f87d80 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_security_cfm+0x3f/0x4b0 net/bluetooth/rfcomm/core.c:2279 but task is already holding lock: ffffffff91f5aec0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_auth_cfm include/net/bluetooth/hci_core.h:2200 [inline] ffffffff91f5aec0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_auth_complete_evt+0x77c/0x1180 net/bluetooth/hci_event.c:3554 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (hci_cb_list_lock){+.+.}-{4:4}: lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 hci_connect_cfm include/net/bluetooth/hci_core.h:2164 [inline] hci_remote_features_evt+0x485/0x9b0 net/bluetooth/hci_event.c:3786 hci_event_func net/bluetooth/hci_event.c:7887 [inline] hci_event_packet+0x8e9/0xcd0 net/bluetooth/hci_event.c:7938 hci_rx_work+0x451/0xfc0 net/bluetooth/hci_core.c:4087 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #1 (&hdev->lock){+.+.}-{4:4}: lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 hci_release_dev+0x160/0x630 net/bluetooth/hci_core.c:2731 bt_host_release+0x6b/0xb0 net/bluetooth/hci_sysfs.c:100 device_release+0xd2/0x270 drivers/base/core.c:2640 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3884 device_release+0xd2/0x270 drivers/base/core.c:2640 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3884 hci_conn_put include/net/bluetooth/hci_core.h:1690 [inline] l2cap_conn_free net/bluetooth/l2cap_core.c:1856 [inline] kref_put include/linux/kref.h:65 [inline] l2cap_conn_put net/bluetooth/l2cap_core.c:1869 [inline] l2cap_chan_destroy net/bluetooth/l2cap_core.c:494 [inline] kref_put include/linux/kref.h:65 [inline] l2cap_chan_put+0x352/0x3f0 net/bluetooth/l2cap_core.c:521 l2cap_sock_release+0x1db/0x280 net/bluetooth/l2cap_sock.c:1533 __sock_release net/socket.c:735 [inline] sock_release+0x91/0x1c0 net/socket.c:763 rfcomm_session_del.isra.0+0x16b/0x250 net/bluetooth/rfcomm/core.c:782 rfcomm_process_rx net/bluetooth/rfcomm/core.c:2086 [inline] rfcomm_process_sessions net/bluetooth/rfcomm/core.c:2171 [inline] rfcomm_run+0x6f6/0x5550 net/bluetooth/rfcomm/core.c:2261 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #0 (rfcomm_mutex){+.+.}-{4:4}: check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209 check_prevs_add kernel/locking/lockdep.c:3328 [inline] validate_chain kernel/locking/lockdep.c:3952 [inline] __lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288 lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 rfcomm_security_cfm+0x3f/0x4b0 net/bluetooth/rfcomm/core.c:2279 hci_auth_cfm include/net/bluetooth/hci_core.h:2203 [inline] hci_auth_complete_evt+0x811/0x1180 net/bluetooth/hci_event.c:3554 hci_event_func net/bluetooth/hci_event.c:7887 [inline] hci_event_packet+0x8e9/0xcd0 net/bluetooth/hci_event.c:7938 hci_rx_work+0x451/0xfc0 net/bluetooth/hci_core.c:4087 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 other info that might help us debug this: Chain exists of: rfcomm_mutex --> &hdev->lock --> hci_cb_list_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(hci_cb_list_lock); lock(&hdev->lock); lock(hci_cb_list_lock); lock(rfcomm_mutex); *** DEADLOCK *** locks held by kworker/u9:4/5624: 4, last CPU#0: #0: ffff88802d674140 ((wq_completion)hci4#2){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90003da7d08 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88805b5780b8 (&hdev->lock){+.+.}-{4:4}, at: hci_auth_complete_evt+0x99/0x1180 net/bluetooth/hci_event.c:3522 #3: ffffffff91f5aec0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_auth_cfm include/net/bluetooth/hci_core.h:2200 [inline] #3: ffffffff91f5aec0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_auth_complete_evt+0x77c/0x1180 net/bluetooth/hci_event.c:3554 stack backtrace: CPU: 0 UID: 0 PID: 5624 Comm: kworker/u9:4 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 Workqueue: hci4 hci_rx_work Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2087 check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2219 check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209 check_prevs_add kernel/locking/lockdep.c:3328 [inline] validate_chain kernel/locking/lockdep.c:3952 [inline] __lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288 lock_acquire kernel/locking/lockdep.c:5942 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 rfcomm_security_cfm+0x3f/0x4b0 net/bluetooth/rfcomm/core.c:2279 hci_auth_cfm include/net/bluetooth/hci_core.h:2203 [inline] hci_auth_complete_evt+0x811/0x1180 net/bluetooth/hci_event.c:3554 hci_event_func net/bluetooth/hci_event.c:7887 [inline] hci_event_packet+0x8e9/0xcd0 net/bluetooth/hci_event.c:7938 hci_rx_work+0x451/0xfc0 net/bluetooth/hci_core.c:4087 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245